PT-2025-12024 · Dask · Dask

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10096

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dask versions <=2024.8.2

Description The issue concerns a vulnerability in the Dask Distributed Server. It allows attackers to craft malicious objects using pickle serialization. These objects can be serialized on the client side and sent to the server for deserialization, potentially leading to remote command execution and granting full control over the Dask server.

Recommendations For Dask versions <=2024.8.2, consider avoiding the use of pickle serialization until a patch is available. As a temporary workaround, restrict access to the Dask Distributed Server to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-10096

GHSA-XQGJ-R6XV-9CW4

Affected Products

Dask

References · 9

• https://cve.org/CVERecord?id=CVE-2024-10096 · Security Note
• https://ubuntu.com/security/CVE-2024-10096 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xqgj-r6xv-9cw4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-10096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10096 · Security Note
• https://github.com/dask/dask · Note
• https://huntr.com/bounties/a4be847b-a52d-42cc-9e78-3299e2d30ab2 · Note
• https://twitter.com/CVEnew/status/1903082106575585632 · Twitter Post
• https://twitter.com/cybercronai/status/1902933560715047408 · Twitter Post